CISSP Practice Question: In a financial services firm, which approach is the BEST for integrating…

Correct Answer: B. Adopt a DevSecOps approach

Explanation (CISSP Manager Logic):

DevSecOps integrates security as a shared responsibility throughout the entire lifecycle rather than treating it as a final hurdle. This proactive approach aligns security with business agility, ensuring risk management is automated and continuous.

By adopting a DevSecOps approach, you:

• Shift security "left" to remediate vulnerabilities early when they are cheapest to fix.
• Foster cross-functional collaboration between development, operations, and security teams.
• Maintain a consistent security posture through automated testing within the CI/CD pipeline.

While the other options are relevant, they fall short because:

• A: Testing only at the end creates bottlenecks and significantly increases remediation costs.
• C: Post-deployment reviews leave the organization exposed to active exploits in production.
• D: Manual reviews are unscalable and cannot keep pace with modern rapid release cycles.

Think like a manager:

Security must be baked into the process, not bolted on. Prioritize systemic integration over reactive checkpoints to balance operational velocity with risk reduction.